CVE-2022-50013: f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()

Q: Who is exposed to this issue?

Systems using the Linux kernel with the F2FS filesystem are exposed when their F2FS metadata has an inconsistency between a NAT entry and the NAT bitmap. The reported triggering path involves setting an extended attribute.

Q: What access does an attacker need to trigger the issue?

The CVSS vector indicates local access with low privileges and no user interaction is required. The failure is reached through the lsetxattr system-call path while operating on F2FS.

Q: What is the practical impact?

An inconsistent NAT entry and NAT bitmap can trigger BUG_ON() in f2fs_new_node_page(), causing an availability impact. The supplied CVSS assessment lists no confidentiality or integrity impact and a high availability impact.

Q: How can I tell whether a system may already be affected?

The reported condition is a node ID marked free in the NAT bitmap while its corresponding NAT entry has a block address other than NULL_ADDR. A kernel crash trace involving f2fs_new_node_page during write_all_xattrs or setxattr activity is also consistent with this issue.

Published Jun 18, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid use f2fsbugon() in f2fsnewnodepage()

As Dipanjan Das <mail.dipanjan.das@gmail.com> reported, syzkaller found a f2fs bug as below:

RIP: 0010:f2fsnewnodepage+0x19ac/0x1fc0 fs/f2fs/node.c:1295 Call Trace: writeallxattrs fs/f2fs/xattr.c:487 [inline] f2fssetxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743 f2fssetxattr+0x233/0xab0 fs/f2fs/xattr.c:790 f2fsxattrgenericset+0x133/0x170 fs/f2fs/xattr.c:86 vfssetxattr+0x115/0x180 fs/xattr.c:182 vfssetxattrnoperm+0x125/0x5f0 fs/xattr.c:216 vfssetxattrlocked+0x1cf/0x260 fs/xattr.c:277 vfssetxattr+0x13f/0x330 fs/xattr.c:303 setxattr+0x146/0x160 fs/xattr.c:611 pathsetxattr+0x1a7/0x1d0 fs/xattr.c:630 dosyslsetxattr fs/xattr.c:653 [inline] sesyslsetxattr fs/xattr.c:649 [inline] x64syslsetxattr+0xbd/0x150 fs/xattr.c:649 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x35/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x46/0xb0

NAT entry and nat bitmap can be inconsistent, e.g. one nid is free in nat bitmap, and blkaddr in its NAT entry is not NULLADDR, it may trigger BUGON() in f2fsnewnodepage(), fix it.

Affected Software

6 affected components

Linux Linux kernel

Linux Linux kernel>=3.8<4.19.256

Linux Linux kernel>=4.20<5.4.211

Linux Linux kernel>=5.5<5.10.138

Linux Linux kernel>=5.11<5.15.63

Linux Linux kernel>=5.16<5.19.4

Event History

Jun 18, 2025

CVE Published

via MITRE·11:01 AM

Data Sourced

via MITRE·11:01 AM

Description

Data Sourced

via NVD·11:15 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using the Linux kernel with the F2FS filesystem are exposed when their F2FS metadata has an inconsistency between a NAT entry and the NAT bitmap. The reported triggering path involves setting an extended attribute.

What access does an attacker need to trigger the issue?

The CVSS vector indicates local access with low privileges and no user interaction is required. The failure is reached through the lsetxattr system-call path while operating on F2FS.

What is the practical impact?

An inconsistent NAT entry and NAT bitmap can trigger BUG_ON() in f2fs_new_node_page(), causing an availability impact. The supplied CVSS assessment lists no confidentiality or integrity impact and a high availability impact.

How can I tell whether a system may already be affected?

The reported condition is a node ID marked free in the NAT bitmap while its corresponding NAT entry has a block address other than NULL_ADDR. A kernel crash trace involving f2fs_new_node_page during write_all_xattrs or setxattr activity is also consistent with this issue.

CVE-2022-50013: f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to trigger the issue?

What is the practical impact?

How can I tell whether a system may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to trigger the issue?

What is the practical impact?

How can I tell whether a system may already be affected?